V2Ray FAQ & Troubleshooting
High-frequency questions about v2rayN, v2rayNG, and v2flyNG, organized by fundamentals, installation and configuration, usage tips, and troubleshooting. Identify the affected stage first, then narrow it down step by step using the logs and configuration.
- Subscription Import
- System Proxy
- TUN Permissions
- V2Ray Routing Rules
- DNS Troubleshooting
Clients, Cores & Proxy Modes
Separating the responsibilities of the graphical client, proxy core, protocol, and system proxy helps prevent import, connection, and routing issues from being treated as the same problem.
What are V2Ray, v2rayN, and the Xray core?
V2Ray generally refers to the ecosystem of protocols and tools built around Project V; v2rayN is a graphical client for subscription management, routing, and system proxy control; Xray is a proxy core that clients can invoke. The graphical interface does not replace the core for handling connections. Instead, it converts settings into a format the core can read and manages its runtime state.
How should you choose between v2rayN, v2rayNG, and v2flyNG?
For Windows, macOS, and Linux desktops, v2rayN is usually the first choice. v2rayNG is widely used on Android, and its core integrates directly with the Xray configurations commonly used on desktop; choose v2flyNG when you need the v2fly core. Also confirm that the protocols and transport methods in your subscription are supported by the selected client and core.
What is the difference between a system proxy, routing modes, and a global proxy?
The system proxy determines whether the operating system and apps that follow its settings send requests to the client. The routing mode determines whether requests entering the core use the direct, proxy, or block outbound. A global proxy generally means that most traffic already entering the client uses the proxy outbound. These operate at different stages, so enabling the system proxy does not automatically control every application.
Can VMess, VLESS, Trojan, and Shadowsocks be used in the same client?
Yes, as long as the client and its core support the relevant protocols, these configurations can be stored in the same subscription group or server list. Fields from different protocols are not interchangeable: VLESS flow, REALITY publicKey, and shortId each serve specific purposes. After importing, check that the protocol, port, transport layer, and security parameters are complete.
What is the difference between a subscription URL and a single share link?
A subscription URL usually returns a group of server configurations that can be updated centrally. A single share link describes only one configuration and does not automatically follow subscription changes after import. Subscription updates may merge or replace group contents according to the client’s rules, so manual edits can be overwritten during the next update. Save long-term custom configurations separately.
Subscription Import & Package Selection
Common installation issues involve subscription URL formats, update methods, processor architectures, and system permissions. Verify the input and selected package first, then adjust settings inside the client.
What should I check first when a subscription import fails?
First, make sure you copied the complete subscription URL without extra spaces, line breaks, or truncation by a chat app. Then add it through the client’s subscription-group feature and run an update. If it still fails, check whether the URL has expired, whether your network can reach the subscription service, and whether the response uses a subscription or share-link format supported by the client.
What if a subscription update fails even though the URL opens in a browser?
Opening the URL in a browser only proves that it is reachable; it does not mean the client can parse the response. Check the client log for the HTTP status, decoding messages, and format errors, then try updating both directly and through the current proxy. If the response is a login page, error page, or empty body, restore the correct response on the subscription service first.
Which should I choose for Android: arm64 or universal?
Most mainstream Android phones released in recent years use 64-bit ARM processors, so arm64 is usually the best choice and typically has a smaller, more focused package. Choose the universal package if you cannot confirm the architecture, the device is older, or the arm64 package will not install. Universal includes resources for more architectures, offering broader compatibility at the cost of a larger package.
How should I choose between the v2rayN desktop edition and the Windows WPF edition?
The desktop edition uses a cross-platform interface and suits users who want a similar workflow across desktop operating systems. The WPF edition targets Windows only, with interface and tray controls closer to the traditional v2rayN experience. Start with the desktop edition for a new installation; choose WPF if you already rely on a fixed workflow or the classic interface.
What should I do when macOS says the developer cannot be verified?
Close the warning, open Privacy & Security in System Settings, find the recently blocked v2rayN entry, and use the system-provided option to open it anyway. Then confirm the launch again. The first run may also request network access; allow it according to your needs, then check the menu-bar status and system proxy settings.
System Proxy, TUN & Split Routing
A client showing that it is running does not mean every application’s traffic has entered the core. System proxy settings, in-app proxies, and TUN cover different ranges of traffic; routing rules then determine the outbound after traffic enters.
The client says it is connected, but the browser cannot access the internet. What should I do?
First confirm that the browser follows the system proxy. Then verify that the client has selected a working configuration and enabled the correct system proxy mode. Temporarily switch to a simpler routing mode to rule out incorrect matching by custom rules. If every configuration fails, inspect the logs for DNS, handshake, certificate-time, and connection-timeout details instead of repeatedly toggling settings.
Why do some apps connect directly even when the system proxy is enabled?
The system proxy affects only apps that read the operating system’s proxy settings. Some programs use their own network stack, a fixed proxy configuration, or UDP connections and may bypass it. Check whether the app has an internal proxy setting, and make sure its SOCKS or HTTP port matches v2rayN’s local listening port. Evaluate TUN mode if you need to capture more traffic.
Why does TUN mode report insufficient permissions or fail to start?
TUN creates a virtual network interface and changes system routes, so it usually requires administrator privileges or authorization for a system network extension. Exit the client, restart it with the permissions required by your system, and allow the relevant network component. If it still fails, check whether another VPN, virtual adapter, security tool, or stale TUN process is using the interface or routes.
How do I route mainland China traffic directly and send everything else through the proxy?
In the routing settings, send geosite:cn, geoip:cn, and geoip:private to the direct outbound, then send all unmatched traffic to proxy. Rule order affects matching: more specific domain or IP rules should come before general rules. Reload the configuration after making changes, then test a direct-access domain and a proxy destination separately.
Should sniffing be enabled?
sniffing can identify the destination domain from a connection, allowing traffic that initially has only an IP address to continue matching geosite domain rules, so it can be enabled in common desktop configurations. It is not required for connectivity. If a particular app shows incorrect domain detection, unwanted rewriting, or conflicts with custom routing, disable it for the relevant inbound and compare the results.
Timeouts, DNS & Local Ports
First determine whether the issue lies in subscription parsing, the local process, DNS resolution, or the remote connection. Keep a minimal configuration and change only one variable at a time; this is usually more effective than changing several settings together.
How should I troubleshoot a node connection timeout step by step?
First confirm that the local network is working, then check the server address, port, protocol, transport method, and security parameters. If multiple configurations time out at once, suspect the local network, DNS, or system clock; if only one times out, focus on that configuration. In logs, timeout, connection refused, and handshake failed point to different stages.
Why is the server list empty even though the subscription update succeeded?
A successful update may only mean that the request completed; the response can still be empty, incompatible, or contain no supported configurations. Check the subscription group’s update log and parsed-item count, then verify whether filters are enabled. If the response is actually a message, web page, or unknown share-link format, the client will not recognize it as a server entry.
How do I fix a log message saying that a port is already in use?
This means the local SOCKS, HTTP, or API listening port is being used by another process, or that the previous core process did not exit cleanly. Fully exit the relevant client and restart it. If the conflict remains, change the local listening port, for example from 10808 to an unused port, and update the proxy port in your browser or other apps.
What if a domain cannot be opened but the IP address responds directly?
This usually calls for checking DNS first. Confirm that the client’s DNS configuration works, that routing rules are not sending queries to an unreachable outbound, and clear the operating system’s old resolver cache. If TUN is enabled, also inspect DNS hijacking or virtual DNS settings. Do not simply replace the node: when the connection outbound is working, the problem may be in domain resolution.
How can I return to a diagnosable state after configuration changes make things worse?
Back up the current configuration first. Then temporarily disable custom DNS, Mux, complex routing, and TUN, leaving only one configuration with verified fields, the default local port, and basic system proxy settings. After validating the basic connection, restore one setting at a time and retest. Adding variables incrementally makes conflicts easier to locate than changing several switches at once.